CVE-2026-84901

Eventin WordPress plugin before version 4.1.22 contains insufficient authorization checks on several of its event-management REST routes. Users with Contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete global event and ...